Systems and methods for securing social media for users and businesses and rewarding for enhancing security

ABSTRACT

The disclosed system and method enhances security of people, organizations, and other entities that use what has been termed “social media.” Recent trends have shown that information posted to social media may cause tremendous damage to individuals and other entities. This includes information that was posted deliberately or unintentionally, including social security numbers, financial data and other sensitive information. Further, information that previously may have been viewed as innocuous, such as location data, has caused harm on certain occasions and may need to be protected. The disclosed system provides a novel method of screening, identifying, and preventing certain information from being posted on social media and other public locations. In addition, the disclosed system and method improves security by motivating people to use security software by offering rewards for its use.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority from provisional application No.61/690,090 filed on Jun. 19, 2012, and provisional application No.61/855,133, filed on May 9, 2013. The contents of both provisionalapplications identified above are incorporated in their entirety byreference herein.

FIELD OF INVENTION

This invention relates to user, organization, and information securityon computer networks and social media services.

BACKGROUND

Traditionally, security risks to computer users—especially thoseconnected to the Internet—were caused by technical vulnerabilities, and,therefore, Internet security packages have historically focused onsecuring against threats that exploit technical vulnerabilities tocompromise electronic resources and/or render technology difficult touse. Internet security packages for consumers and other individual userstypically include anti-virus, anti-malware, anti-spam,anti-phishing/anti-malicious-websites, firewall, basic intrusionprevention and detection, and other technical-type defenses. Serversecurity systems typically include technology that is more robust and,in addition to providing more powerful versions of the types of defensesthat existed for end users as described above, address the additionalrisks to the organizations providing services via the servers—typicallyfunctions like authentication, authorization, and other server-specificrisks.

Various network security systems and other types of technical defenseswere also developed, marketed, and deployed. But, in each of thesecases, the digital security was primarily intended to address technicalvulnerabilities, and when human error was being addressed by suchtechnologies it was in the context of human error creating thosetechnical vulnerabilities (for example, if a human turned off anti-virussoftware, an Internet security software package might, upon checking themachine, warn the user that that a technical vulnerability existed inthat anti-virus software was turned off). Even enterprise-levelmanagement packages work by addressing technical risks in such afashion. In the previous example, an enterprise-level utility mightprevent a user from accidentally turning off anti-virus software oropening up personal firewall ports, or might correct the situation if auser did so. Software offered as a service (SaaS) models ofimplementations, and the proliferation of mobile devices, did notdramatically alter the offered security solutions either; sincetechnical defenses were used to secure against technical risks, withpackages being essentially (significantly scaled down versions of)anti-virus, anti-phishing/anti-malicious-websites, and personalfirewalls with some additional mobile-specific functions such as remotewipe capabilities. Even with the mass adoption of social media and itsusage, security packages that offered “social media security” did so byscanning social media for links to rogue websites, malware, and thelike. The basic concept of digital security—securing against technicalrisks—did not change, and until the present invention, remainsunchanged.

While ensuring security against technical risks remains important, a newseries of security risks has emerged, and, prior to the presentinvention, a major risk—in fact what may be the greatest risk—to usersof social media has not been addressed. Whereas malware and othertechnical risks may once have been the biggest problem for users, todaythe risks associated with the divulging of information that a user doesnot intend to divulge, or that the user intends to divulge but does notunderstand the consequences of divulging, or that the user thinks isbeing divulged to particular party or parties but in fact is beingdivulged to others as well (or instead), may be more significant,especially since no real countermeasures have been developed until thecurrent invention.

While some people are aware that one should not explicitly postsensitive information in social media that is publicly viewable—such asposting one's email password on a Facebook wall or timeline—it is quitecommon for users not to realize the consequences of their postings insocial media, or the postings of others that may have relevance to them.Information that can be extrapolated from what the user may think areinnocuous postings, settings, or other aspects of social media can beseriously damaging to the user. As one example, some people continue touse their mothers' maiden name as a password for accessing theirfinancial and medical data—yet this information can often easily begleamed by anyone viewing their Facebook profile. Likewise, people maypost information that impacts their employers, organizations for whichthey volunteer, and other entities. A user who, using a social mediasite, suddenly connects with multiple people in the mergers andacquisition practice of a law firm that services his employer, forexample, may cause others to realize that his employer is considering asale.

The great risk of unintended consequences of both intentionally andunintentionally sharing information through the use of social mediaplatforms by users and others has emerged and poses a serious threat inthe present day—yet no current security product addresses it. Users ofsocial media often post items (including information, text, cartoons,videos, photos, sound bites, and other forms of media)—or haveinformation posted about them, or associated with them by others, byapps, or by computers themselves (often without the knowledge of theuser)—that may expose them—or increase their exposure to—one or morenegative consequences. Businesses may be put at competitive risk, oreven get into trouble for violating regulations, as a result of socialmedia posts. It is important to realize that a problematic item orcontent which can cause negative consequences is not necessarily anegative or derogatory sounding posting. If an employee of a companyposts a comment online that is highly complimentary of products of thatfirm's direct competitor, that post, while sounding positive, may hehighly negative in effect for the poster and his or her employer.

Examples of information sharing that can lead to harmful consequencesinclude:

-   -   sharing information about a person's family relationships, place        of employment, and interests can be leveraged by criminals as        part of identity theft;    -   sharing information about a person's children and their        schedules may help facilitate kidnapping, break-ins into the        person's home while he is carpooling to work, or other harmful        actions;    -   publishing evidence that a user has engaged in potentially        controversial activities, such as photographs of alcohol and        drug consumption, smoking, using weapons, participating in        various activities, viewing materials in which people appear in        various states of undress, crass humor, dressing in various type        of garments, viewing or posting racist-type materials,        associating with certain characters, and other examples of        potentially problematic or controversial activities—could impact        a person's business, employment, or social prospects;    -   sharing various types of information that may impact a user's        relationships, such as a photo of a man holding another woman,        and vice versa, could impact his or her relationship with a        girlfriend or spouse;    -   sharing information related to financial or medical activities        may lead to disclosure of very sensitive and private        information. For example, photographs or location data placing a        person at a particular medical facility may divulge that the        person suffers from a condition which that facility is known to        specialize in treating;    -   included in social media would be gaming sites in which posting        dialogue, stats, interests, etc. can lead to problems, by, for        example, allowing an employer to discern that an employee was        playing during work, allowing teachers to determine that a        student was playing during school hours when she was supposed to        be home sick, publicizing all sorts of private and personal        information. Moreover, criminals know to look at these sites for        information about people;    -   sharing or leaking confidential information about a business's        customers, competitors, research, contemplated products,        potential litigation or exposure to liabilities, etc. can lead        to problems for that business. Various types of such leaks may        even violate the law, such as, for example, securities laws        relating to public disclosure;    -   publication of information regarding a person's connections in        social and professional media may signal implications for the        person's employer. For example, an employee who works in the        legal department connecting with multiple people from a        competing organization, or with parties involved with Mergers        and Acquisition services, may signal potential M&A activity of        his employer;    -   sharing photographs or making posts relating to a domestic or        international geopolitical issue may result in increased        government surveillance, or incorrectly being associated by        government agencies with various dangerous groups; and    -   sharing photographs and videos of an employee pictured with, or        commenting about, a competitor's offering can lead to potential        lawsuits (for example, if the employee speaks negatively about        the offering with inaccurate information), or in a competitor        obtaining an advantage (if the employee endorses the        competitor's product on camera).

Naturally, many other examples are possible, but the aforementionedillustrate why there is concern about the unintended consequences ofsharing of information through social media. Additional examples will bepresented in the following discussion and descriptions.

Furthermore, because social media is relatively new, people are not asknowledgeable of the risks related to its usage as they are to mostother computer security issues. At least in much of the Western world, ageneration of people is presently being raised whose parents arefamiliar with the concept of computer viruses and the need foranti-virus software. The new generation will be, for example, instructedby their parents about the risks of viruses and the need to useanti-virus software, much like earlier generations were taught about thedangers of fire and flammable materials. However, no child growing uptoday has parents who used social media for more than a few years (sincesocial media is only a few years old). Moreover, none of today's parentswere educated when they were young about the risks of socialmedia—creating a situation in which a huge percentage of the populationdoes not understand the full risks of social media usage, and as aconsequence, younger people cannot be properly trained about its risks.Likewise, employers have proven unprepared for dealing with socialmedia—which poses risks with which they have never had to previouslydeal.

As those skilled in the art will recognize, the non-technological risksof social media are significant. These risks are exacerbated by ageneral lack of awareness by the public of the risks, the lack ofpreventive action by the public that can avoid social media problems,and non-existence of technologies that can address the risks in anyautomated fashion prior to the invention.

Furthermore, as those skilled in the art will recognize, most people donot like to make efforts in order to ensure cyber security. People oftendo not recognize, or dismiss, the magnitude of risk to themselves ifthey avoid taking action, and consequently they don't take anypotentially preventive action. Therefore, anything that can successfullymotivate users to improve security, or to utilize security-improvingtechnology, has significant benefits. Today, social media users areaccustomed to responding to posts from businesses that give awayfreebies or offer discounts for performing various simple, non-invasiveactions. In addition, social media has become a major sociological forceand people often enjoy participating therein. As such, a system ormechanism that, in addition to improving security, would offer sometangible incentive for users to improve security, that mechanism couldgain wide acceptance and make a big difference. This is especially trueif the system, which leverages social media to reward users, is intendedfor use by people who are already known to use social media.Furthermore, people typically like to be recognized at work, so a rewardsystem implemented by an employer for employees who utilize a securitysystem can be highly effective.

In addition to all of the above, parents and other guardians may wish tosecure their children or others from various risks of public informationsharing, some of which are described herein. Likewise, businesses andother organizations want to protect themselves as well as peopleassociated with them (employees, board members, contractors, partners,etc.) from the risks described above, and also from running afoul ofregulatory or legal requirements. One problem faced by businesses,parents, and other guardians in implementing a security solution istheir appearance as a “Big Brother,” which frequently comes with activemonitoring. Another problem is that certain types of monitoring bybusinesses and individuals may be illegal.

Even if the monitoring is legal, it is both an arduous task, andsomething which, in a best case scenario, will still cause a lot of illwill, employee dissatisfaction, and negative publicity. To addresssocial media risks, some businesses have prohibited the use of socialmedia by their employees at work, but stopping people from using itduring off hours is nearly impossible, and the risks remain if suchaccess is allowed. Furthermore, social media is becoming increasinglynecessary for business—so prohibitions on use are becoming impracticaland an impediment to success. Likewise, scenarios in which employeesbring their own mobile devices to work render it nearly impossible toprohibit social media access while at work.

It is therefore the object of the present invention to provide a systemand method for solving the problems outlined above.

SUMMARY

The present invention provides systems and methods for securingindividuals, organizations, and other entities from unintentionaldisclosure of potentially harmful information to social media or otherpublic channels. In one embodiment, the system scans ‘sharing’ anduploading requests by users for potentially harmful information, andtakes appropriate action based on certain rule sets. The system mayperform scans either in real time, as a user uses social media; after auser enters information into social media; as he or she types on socialmedia before he or she even submits the information to the social media;as it is entered by the user but before it actually appears to others;in batch mode; or through other means. The system may also periodicallyscan a user's social media contents.

In one embodiment, the system warns users that their ‘sharing’ requestcontains potentially harmful information. In another embodiment, thesystem automatically or with user input removes, adds, or modifiesuploaded data, multimedia, or other items. The system may also delaysharing or quarantine ‘shared’ data based on certain rules and analysis.In another embodiment, the invention may also scan other Internet venuesfor potentially harmful data.

In one embodiment, the system rewards users for using the implemented orother security system to secure themselves and others. In anotherembodiment, the system facilitates profiting by a party offering thesecurity system to users by enabling third-parties to market theirofferings for free, at a discount, or through some other arrangement tousers of the security system, or in exchange for points earned for usingthe system.

Another aspect of the invention is to ensure that a user's social mediapresence, or another party's social media presence that links,references, or names the user, is presenting only the information thatthe user intends to present, and/or only to the parties the user intendsto present it. In another aspect, the system presents the user with thepotential consequences of sharing information before allowing the userto make the information public.

Various embodiments of the invention address risks including, but notlimited to:

-   -   competitive risks, such as leaking info about planned products,        contemplated M&A activity, marketing strategy, R&D, or        vulnerabilities to competition;    -   intellectual property risks, such as leaking information that        compromises intellectual property;    -   regulatory and legal risks, such as leaking quarterly numbers        before officially announced, providing insider information, and        leaking employee, medical, or financial information;    -   physical risks, such as providing information which assists        criminals to kidnap, rape, or burglarize;    -   reputational risks, such as disclosing “sins,” or drug and        alcohol use;    -   personal risks, such as affairs, questionable interests,        disclosing medical conditions, or outing undisclosed sexual        practices; and/or    -   professional risks, such as unprofessional behavior, looking for        new job, looking to move far from job, or seeking to become        pregnant.

Various embodiments of the present invention may be implemented in anumber of ways, including, for example, as:

-   -   an app or other program on a mobile device running as a separate        application;    -   an app or other program that runs within the confines of a        social media platform (e.g., a Facebook app);    -   an app or other program that runs on a computer;    -   an SaaS app or other program that runs on a separate server;    -   an app or other program on a computer or mobile device that        serves only as an interface with which to interact with the        user, but all logic and scanning done from a server;    -   an app or other program that leverages APIs of social media        platform(s); and/or    -   a combination of the aforementioned technologies or other        embodiments mentioned elsewhere in the specification and        drawings.

As those skilled in the art recognize, once an item is shared via socialmedia it is very difficult, or may be impossible, to erase the item andguarantee that the item will stay erased, since someone could have takena screenshot of it before erasure or otherwise recorded it. Hence, theproactive prevention of posting potentially harmful information that theuser may later regret posting is important, and is addressed in thisinvention. Furthermore, the ability to remove offending items fromsocial media as quickly as possible is also important, and this featureis also facilitated by the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates one possible embodiment of a cloud based social mediaservice.

FIG. 2 illustrates a social media conversation between three users.

FIG. 3 illustrates social media sharing by a user.

FIG. 4 illustrates a social media conversation between two or moreusers.

FIG. 5 illustrates an example of a digital photograph with a creditcard.

FIG. 6 illustrates a process of unintentionally publishing a credit cardnumber.

FIG. 7 illustrates an example of a digital photograph with aconfidential document.

FIG. 8 illustrates a process of unintentionally publishing aconfidential document.

FIG. 9 illustrates an example of layers of a computer architecture.

FIG. 10 illustrates an example of several computer components of asocial media service.

FIG. 11 illustrates several modules of one embodiment of the invention.

FIG. 12 illustrates additional modules of one embodiment of theinvention.

FIG. 13 is a flow chart illustrating one embodiment of functionality ofthe present invention.

FIG. 14 is a flow chart illustrating one server based embodiment of thepresent invention.

FIG. 15 is a flow chart illustrating one mobile device based embodimentof the present invention.

FIG. 16 is a flow chart illustrating one distributed embodiment of thepresent invention.

FIG. 17 is a flowchart illustrating one embodiment of after-postingscanning of the present invention.

FIG. 18 is a flowchart illustrating one embodiment of continuousscanning of the present invention.

FIG. 19 is a flowchart illustrating one embodiment of scanning ofsubmitted text of the present invention.

FIG. 20 illustrates a warning notification presented by one embodimentof the present invention.

FIG. 21 illustrates a configuration screen for one embodiment of theinvention.

FIG. 22 illustrates a second configuration screen for one embodiment ofthe invention.

FIG. 23 illustrates an example of an employee action that has unintendedconsequences for the employer.

DETAILED DESCRIPTION

For the purpose of convenience, the specification and drawings may referto various aspects of the invention as a Data Security System (“DSS”) ora Data Security Module (“DSM”). These monikers are not intended tounnecessarily narrow or constrain the invention, but rather are used forbrevity. Depending on the embodiment of the invention, described indetail below, the DSS may comprise one or more DSMs.

FIG. 1 illustrates some of the components that are typical in a modern,cloud-based, computer network. Social Media Service 100 is based in thecloud, and comprises equipment such as edge device 150 (which can be arouter or server with load-balancing features), an application server160 (which performs the heavy data processing required by large scalesystems), and web server 170 (which provides the public with access todata hosted on the social media site). One of ordinary skill in the artwill recognize that the word “server” is not limited to a single serverbox or computer, and can refer to a distributed system with numerouscomputer components and instances. User 110 accesses the social mediasite via smart phone 130, and user 120 accesses the site via laptop 140.Generally, when users want to share data on the social media site, theyupload text, photographs, multimedia, or other data through edge device150, which forwards the data to an appropriate application server 160,which, after processing the data, makes it available to the public, or acertain subset of the public, via web server 170.

FIGS. 2-8 illustrate some of the problematic situations addressed by thepresent invention. In FIG. 2, User A (such as user 110 from FIG. 1) isinvolved in a public conversation, available for viewing by others, suchas the case with most Facebook wall and timeline postings. User B beginsthe conversation by asking “What happened to Dave?” User C responds bysaying “He got arrested.” User A, not having all information required tomake a wise decision, and perhaps without comprehending the consequencesof his musings, quips “LOL!” on the same conversation strand.Unfortunately for User A, User D was arrested for sexual assault, acharge not many people would find amusing. User A's comment is nowpublic, and even if User A subsequently deletes the comment, it haslikely been seen by dozens, if not hundreds, of other people.

In FIG. 3, User B uploads a photograph of User A, and captions it with“User A #drunkbasketball.” Unbeknownst to User B, User A is on probationand not permitted to consume alcohol. Even if the hashtagged phrase isincorrect, User A now has some explaining to do to his or her probationofficer.

In FIG. 4, User A participates in a Twitter type conversation. Username,who for the purpose of this hypothetical happens to be a convicted drugdealer, tweets “No more drug laws.” Somehow seeing the tweet, User Aresponds with “@Username truth.” Unintentionally, User A startedparticipating in a public conversation with a convicted felon.

FIGS. 5-8 illustrate other scenarios where confidential information isunintentionally made public. FIG. 5 illustrates a digital photograph oftwo people, one of whom is sitting behind an office desk. The photographalso includes a credit card, which was lying face up on the desk. InFIG. 6, at step 610, the user of a mobile device views the photographfrom FIG. 5 on the mobile device's display. Unable to see great detailon the small screen, the user elects to share the photo on a socialmedia site in step 620. In step 630, the user selects a ‘Share’ functionin a social media application or gallery app on the device. In step 640,the mobile device uploads the photo to the social media site. In step650, the social media concludes the unintentional leak by making thephoto available to the public. The high resolution with which thephotograph was taken provides plenty of detail from which the creditcard number and expiration date can be discerned from a computer.

FIGS. 7-8 illustrates a scenario in which a highly confidential businessdocument is unintentionally leaked to the Internet. FIG. 7 illustrates adigital photograph of two people, one of whom is sitting behind anoffice desk. The photograph also includes a highly confidential businessdocument that is lying face up on the desk. In FIG. 8, at step 810, abusiness employee views the photograph from FIG. 7 on a mobile device'sdisplay. Unable to discern any details on the small screen, the employeeelects to share the photo on a social media site in step 820. In step830, the employee selects a ‘Share’ function in a social mediaapplication or gallery app on the device. In step 840, the mobile deviceuploads the photo to the social media site. In step 850, the socialmedia concludes the unintentional leak of highly confidential businessinformation by making the photo available to the public. The highresolution with which the photograph was taken provides plenty of detailfrom which the confidential document can be viewed on a computer.

FIG. 23 illustrates a scenario in which an employee unintentionallyhands his employer's competitor an advantage. In FIG. 23, at step 2310,employee of company Y opens a social media app on his device. At step2320, the employee types “I love Soda X!” and selects the ‘Share’function in the social media application at step 2330. At step 2340, themobile device uploads the comment to the social media site. In step2350, the social media concludes the unfortunate process by disclosingthe fact that employee of company Y loves soda made by company X,company Y's competitor.

The present invention can eliminate the information leaks and mishapsillustrated in FIGS. 2-8.

Architecture

In the preferred embodiment, the present invention is implemented insoftware. One of ordinary skill in the art, however, will understandthat the present invention may also be implemented in firmware,hardware, or a combination of the above. Indeed, certain performancegains may be obtained by offloading some aspects of processing done byDSS to specialized, or specially configured, devices. As a generalmatter, various embodiments of the DSS may run on a number of differentcomputer devices, including, but not limited to, cell phones, smartphones, tablets, laptops, notebook computers, desktop computers,routers, switches, telephony devices, and computer servers. In thepreferred embodiment, the DSS is implemented on one or more computerservers.

FIG. 9 illustrates various layers that may be present in a typicalcomputer system, including hardware layer 910, operating system layer920, applications layer 930, virtual machine layer 940, and othersoftware 950 running on top of the virtual machine. One of ordinaryskill in the art will recognize that not all layers appearing in FIG. 9necessarily appear in all computer systems. Indeed, numerous computersand devices do not run virtual machines, and some even run withoutapplications. Data Security Module 960 (“DSM”) is one embodiment of thepresent invention, and as shown in FIG. 9, the DSM may be implemented ina number of layers of computer architecture. In the preferredembodiment, the present invention runs on a dedicated server, or runs asone of several applications on a server.

FIG. 10 shows several embodiments by which a cloud service provider,such as a social media site, may implement the data security systemdisclosed herein. The site may include DSS functionality on edge device1010, application server 1020, web server 1030, or even a dedicated DSSserver 1040. It will be understood by one of ordinary skill in the art,that various modules of the data security system may be separated amongmultiple computer servers.

FIG. 11 illustrates various modules that may comprise the DSS, includingInput Module 1110, Interception Module 1120, Recognition Module 1130,User Interface Module 1140, Output Module 1150, Encryption/DecryptionModule 1160, Server Interface Module 1170, and Controller Module 1180.

In one embodiment, the DSS comprises an Input Module 1110 through whichthe DSS receives data requested to be shared or uploaded. In oneembodiment, Input Module 1110 runs on a server and receives requestsfrom users to share or upload data. The requests may first be receivedby an edge device, and forwarded to the Input Module. In anotherembodiment, Input Module 1110 runs on a mobile device, possibly as partof a social media or gallery app and is designed to receive requests toshare or upload data from a user.

The DSS may also comprise an Interception Module 1120, which may, forexample, be present on mobile devices as part of the operating system.In one embodiment, Interception Module 1120 intercepts requests to shareor upload data by users, so that the requests can be vetted by the DSS.It will be understood that Interception Module 1120 may also run on aserver.

In the preferred embodiment, the DSS comprises a Recognition Module1130, which scans shared data for general or specific characteristics,such as text strings or images. Recognition Module 1130 is described infurther detail in FIG. 12 and accompanying text. Recognition Module1130, and one or more of its components, may reside on a mobile device,a server, or be distributed on multiple machines. In one embodiment,Recognition Module 1130 also determines the type of data requested to beshared or uploaded by the user.

In the preferred embodiment, the DSS comprises a User Interface Module1140, which facilitates communications with users of mobile devices andother computers. User Interface Module 1140 may, for example, notifyusers that their attempted upload of data violates company policy, orunintentionally discloses confidential information. As with othermodules, the User Interface Module 1140 may run on a mobile device, aserver, or a computer, among other possibilities. It may also bedistributed between the two.

Output Module 1150 is also present in some embodiments of the DSS.Output Module 1150 is responsible for processing, modifying, and/orforwarding user ‘sharing’ and upload requests in accordance with therule sets. For example, if one of the implemented rules requires anautomatic redaction of a user's social security number from a text or aphotograph file, Output Module 1150 performs the redaction and forwardsthe file for publication to a server. Output Module 1150 may worktogether with other, more specialized, processing modules to attainperformance improvements for its functions.

Some embodiments of the DSS comprise Encryption/Decryption Module 1160,which handles cryptographic communication from and to the DSS. In oneconfiguration, where the DSS is running on a server, mobile and otherdevices may wish to encrypt communications to the DSS. However,communication within the server network may be unencrypted forefficiency and other reasons. In this scenario, Encryption/DecryptionModule 1160 would decrypt communications received at the DSS server forfurther analysis and processing. When the DSS runs on a mobile device,Encryption/Decryption Module 1160 is configured to encryptcommunications from the mobile device to a server.

In one embodiment, the DSS comprises a Server Interface Module 1170,which is designed to interface with one or more servers comprising theDSS or providing related services. Server Interface Module 1170 mayprovide several functions, such as configuring messages to comply with acommunications protocol used by the DSS, or to send ancillary data tothe DSS server. For example, a Server Interface Module 1170 running on amobile device may periodically update the DSS server with informationregarding a user's social media habits, such as frequency of visits,what kind of media the user prefers sharing, and collected information.This way the DSS may increase efficiency by routing requests from theuser to servers better equipped to handle the user's preferences. Inanother example, a Server Interface Module 1170 running on a server cancoordinate various DSS functions performed on several servers.

Certain embodiments of the DSS comprise a Controller Module 1180, whichis responsible for managing the various modules, functions, andprocesses of the DSS. Controller Module 1180 may be implemented as acontinuously running task that initializes and maintains all requisiteprocesses. Under certain conditions Controller Module 1180 may shut downand re-activate other modules. Controller Module 1180 also coordinatesthe various components of the DSS in implementations where the DSS isdistributed across multiple servers.

The DSS may comprise other modules, not shown in FIG. 11, with functionssuch as logging, backup, crawling, facial recognition, semanticprocessing, and all of the other functions that are disclosed herein.

The DSS, as disclosed herein, provides flexibility to its administratorsand users, and therefore not all modules must be present in everyembodiment. For example, not every implementation of the DSS must havean Encryption/Decryption Module, or an Interception Module. Further,since in some embodiments the DSS is implemented on a distributedsystem, some of the modules shown in FIG. 11 may run on differentcomputers, or different portions of a single system. Moreover,functionality of some or all of the modules shown in FIG. 11 may becombined into a single module of software or hardware.

FIG. 12 illustrates Recognition Module 1200, which is shown as module1130 in FIG. 11. The primary purpose of Recognition Module 1200 is toscan user requests to share or upload data and to detect variouspatterns or items of information that the DSS is configured tosafeguard. In some embodiments, Recognition Module 1200 is alsoconfigured to apply rule sets, or to compare user requests to share orupload data with various rules. Recognition Module 1200 may itselfcomprise one or more modules, such as Image Recognition Module 1210,Optical Character Recognition Module 1220, Encryption Recognition Module1230, Text Recognition Module 1240, Sound Recognition Module 1250, andPattern Recognition Module 1260. As noted above, in some embodiments,Recognition Module 1200 may also comprise one or more Rule Sets 1280.

The recognition modules identified above and in FIG. 12 can beimplemented in a variety of ways. In one embodiment, the recognitionmodules are dedicated processors, each configured to process a certaintype of data, such as images by the Image Recognition Module 1210, textby the Text Recognition Module 1240, and sound by Sound RecognitionModule 1250. Thus, for example, Image Recognition Module 1210 (“IRM”)may be a dedicated graphics board or software that sits idly untilanother DSS module feeds it with a photograph that a user wants to shareon a social media site, and also with an image of a credit card that theDSS is configured to prevent from being publicly disclosed. This mode isreferred to as “idle mode” herein. The IRM would scan the sharedphotograph, detect that the photograph also contains an image of thecredit card, and report the finding to the DSS controller or othermodule. This implementation would, for example, prevent the type ofinadvertent disclosure illustrated in FIGS. 5 and 6. In anotherembodiment, referred to as an “active mode” herein, instead of sittingidly until requested to analyze an image by the DSS, the IRM isconstantly scanning uploaded photographs and other images for patternssuch as faces, shapes of documents, and credit cards. This embodimentmay improve efficiency and response times. In addition, this embodimentcreates a number of other possibilities for the DSS, such as predictivescanning, described in further detail below. In other embodiments,referred to as “hybrid modes” herein, the IRM may behave partially as itwould in idle mode and partially as it would in active mode, forexample, by actively scanning for a particular type of image or pattern.The IRM may also work with video files, since video files areessentially collections of still images. In the case of compresseddigital video, such as MPEG, the IRM would de-assemble various I, P, andB frames into individual components and scan them separately. One ofordinary skill in the art would recognize that efficiency improvementsmay be attained by combining techniques used in digital video and imagecompression to quickly scan moving pictures for specific patterns.

Turning to the other recognition modules, in the preferred embodimentOptical Character Recognition Module 1220 (“OCRM”) is configured to scanimages for text, in one or multiple languages. In the preferredembodiment, the OCRM is also customizable to include additional,previously undefined, symbols and characters, so that it is not limitedto a predefined set of characters.

In the preferred embodiment, Encryption Recognition Module 1230 (“ERM”)scans incoming data for the presence of encryption. This functionalityis valuable to government agencies, defense contractors, and otherorganizations interested in securing highly sensitive information. In apossible scenario, a defense contractor employee may try to upload atext file containing encrypted specifications for a military system to asocial media site or an unsecured server. While the text file may nottrigger any alarms based on its contents, the ERM would detect thepresence of encryption and at a minimum notify the DSS, and possibly DSSadministrators that encryption was detected. Encryption/Detection Module1230 may assist in decrypting the data. The ERM may also work togetherwith other recognition modules to detect the presence of encrypted datain different types of media.

Text Recognition Module 1240 (“TRM”) is preferably configured to detectvarious textual patterns in one or more languages. The TRM may work withother modules to help convert safeguarded information, such as a creditcard number, to other forms of media, such as a sound file or an image.This way a credit card number stored in text will be scanned for by therecognition modules in textual, audio, and visual form.

If implemented, Sound Recognition Module 1250 (“SRM”) detects variousaudio patterns in uploaded or shared data. The SRM works together withother recognition module to enable scanning for specific patterns in amultimedia environment. Thus, a password stored in an audio file, soundsconnoting sexual activity, sounds of illegal activity, sounds ofintoxication or other “controversial” activity, or other sounds. may beconverted to other forms of media and scanned for using otherrecognition modules.

In the preferred embodiment, Pattern Recognition Module 1260 (“PRM”) isone or more recognition modules that search for patterns of data inuploaded or shared user information. In one embodiment, the PRM maycombine the features of one or several recognition modules in searchinga hybrid data file. In another embodiment, the PRM may scan non-standardmedia files, such as those used for specialized industrial applications.For example, the PRM may be configured to scan a computer aided designfile used by AutoCAD or SolidWorks for various patterns, including textand images.

Preferably, each of the recognition modules illustrated in FIG. 12 iscapable of functioning in idle, active, and hybrid modes. In addition,each of the recognition modules is preferably capable of acceptingvarious recognition settings, such that DSS administrators and users canfine-tune its ability to deal with different sound levels, imagequality, and other parameters.

The Recognition Module embodiment illustrated in FIG. 12 comprises rulesets which provide criteria by which patterns in user data may bedetected, and based on which actions may be taken. In other embodiments,the rule sets may be an independent module, of their own. Indeed, anentire database server may be dedicated to storing and providing rulesets upon request to the DSS. Further, the rule sets may be split intoseparate types of rules, such as, for example, rules for patternrecognition in user data, and rules pursuant to which the DSS makesdecisions of what to do with user data that may, or may not, trigger acondition.

The Rule Sets 1280 illustrated in FIG. 12 may comprise different typesof rules, including Administrator Defined Rules 1282 (“ADRs”), UserDefined Rules 1284 (“UDRs”), and Custom Rules 1286 (“CRs”). ADRs areconfigured by administrators of the DSS, such as a network administratorat a Fortune 500 company that has implemented a DSS embodiment. UDRsprovide users with an opportunity to configure their own safeguardingrules. CRs may include other types of rules, such as rules created bythe DSS as part of predictive scanning Various Rule Sets are describedin detail further in the specification.

Implementation

Overview

One possible implementation of the DSS is illustrated in FIG. 13. Atstep 1300, a user installs a DSS app on his mobile device. Onceinstalled, at step 1310 the app asks the user if he or she wants toconfigure settings now, or on the fly as the app detects potentialsocial media issues. At step 1320, the app may also ask the user if heor she wants to answer certain questions whose answers the system couldnot, for whatever reason, gather from the user's social media profiles(e.g., user profession, home location, etc.). If the user chooses toconfigure on the fly, the app then indicates that it will now commenceconfiguring itself and securing the user, and when the system detectsissues based on a standard rule set it will prompt the user how tohandle those issues for the current situation and for the future. If theuser selects to configure it him or herself, the app provides the userwith the opportunity to review the standard settings and variables—i.e.,the items of interest that the DSS will look for in order to safeguardthe user pursuant to standard rule sets—and to configure how the userwants the DSS to handle each discovered item. In some implementations ofthe invention there may be scoring involved—such that a rule may ratethe discovery of a certain item as a risk on a scale of 1 to 100, forexample, rather than a YES or NO match, and the user can configure howthe various levels of risk should be addressed. For example, a user mayconfigure the DSS so that scans for comments with specific offensivelanguage are rated as a significant problem (by setting the appropriatescore greater than alpha), and accordingly those comments should beimmediately deleted. Scans for comments set to lower risk levels(defined, for example, by different words or text patterns) should behandled by simply notifying the user, or may be handled based on rulesthat provide for different actions depending on who has visibility.After finishing up its initial configuration, in step 1340 the DSS asksthe user if it can now start securing. If the user says yes, the systemwill ask the user which social media venues to secure and at step 1350either prompt the user for credentials to login to the various socialmedia sites that the user wants secured or login using authenticationcapabilities of those sites (e.g., Facebook Authentication). Inimplementation of the invention that run as social media apps (e.g.,Facebook apps) the login is not needed. Rather, the user may only needto ‘authorize’ the app.

The system may also ask the user if it can perform a full scan of eachsocial media platform where the user has a presence. If the user want tosecure his Facebook only, for example, in step 1360 the system will scanthe Facebook wall, configuration, newsfeed, timeline, friend list,friend pages, comments, and other parts of Facebook looking for itemsthat match any of the rules the user either configured or that come inthe default configuration. If the configured system supports spideringit will do so as well. In step 1370, the DSS presents the user withresults of its scans and crawls, noting which rules the results match,and provides the user with options on how to handle each match—forexample, delete; delete and notify (the poster of the deletion andoptionally the reason and the fact that this was done by the DSS);quarantine until a later time; modify (where applicable and possible toedit the matching content to remove the offensive element, or possiblyasking the user how to modify the content. The DSS may also makesuggestions regarding edits. Edits of content may also be more thansimple edits of text. For example, if a user posts a picture of his orher first car, the system may suggest that besides removing it, the usermay also consider making the picture viewable to only closerelatives—who probably already know what his first car was anyway. Afterthe user makes various selections prompted by the DSS, the DSS updatesthe user's configuration and executes the selected options accordinglyat step 1380. The DSS may then inform the user that it will go intoactive-secure mode whereby it the DSS will monitor any posts the usermakes to Facebook via the mobile device as he or she makes them, performa scan whenever a Facebook notification comes in to the device, and scanfor any Facebook updates every X hours, minutes, or other period oftime. The DSS may also ask the user if he wants to change any of theseparameters. The DSS may also offer to inform the user of securityupdates, by, for example, sending email to the user's Facebook inbox orother account. In step 1390, the system also informs the user that hewill earn rewards points for using the DSS, and that he or she canredeem points by selecting the Redeem points function within the app.The DSS then continues executing with the updated options and securingthe user from inadvertent disclosure of potentially harmful information(shown as step 1395). On subsequent starts, user input is not required,and the system may be configured to scan everything again periodicallyor to scan just the items that changed since the last scan. The above isone example out of many possible implementations of the invention.

In one embodiment, the DSS may be implemented as a cloud based Facebookapplication that leverages the Facebook API. The Facebook API allows theapplication to receive data directly from Facebook upon certainconditions. In this embodiment, the DSS app will use the so-calledFacebook Graph API which allows for communication of real-time updatesto the app by providing it with a mechanism of subscribing to changes indata on Facebook. The DSS includes various modules described in thespecification and drawings. The application runs on a server or set ofservers at an Internet hosting facility (or other location) notbelonging to Facebook or to the user. In this embodiment, the DSSsystem's modules are running on Linux-based servers using an Apache webserver and a Ruby on Rails application, all of which is hosted on a setof virtual servers at a third-party hosting center with high speedInternet connectivity. The Ruby on Rails application is a website thatprovides the interface for configuring user settings and for acceptingdata updates from Facebook. The DSS uses a standard MySQL database tostore data settings and other data. Updates from Facebook are receivedwhen a user using the DSS posts something on Facebook—regardless of howthe post occurs. The communication of the update can be achieved in atleast two ways: (1) Facebook performs an HTTP POST to a URL on theDSS—as per the way the Facebook API works, in which case Facebook sendsover the user's Facebook user ID (which is a long number) as well as thedata from the post and some other metadata; and (2) the DSS detectschanges in the user's status by polling Facebook and noticing a changefrom the last update by comparing the current status with the previousone. Whenever a user's Facebook status is found it is stored in thedatabase along with its Facebook associated user ID so that it can becompared to the next one that appears, and so the scanner code(discussed below) can read it and scan it.

In addition to the software modules mentioned above there is also ascanning service running on the same server or on another server. In ourexample, the scanning service it is on a separate virtual server at thehosting provider. Whenever a new entry is put into the scan database thescanner runs. The scanning service uses standard string comparisonlibraries and natural language processing libraries, and calls them toperform one or more comparisons to the data from the rule sets that theuser has chosen previously to enable.

This configuration is done by the user placing checkmarks in thecheckboxes before each rule and selecting parameters from pick downlists on the configuration page. Contact preferences are setsimilarly—by placing checkmarks in front of the various options that theuser wishes to select. The configuration setup page is served via theRuby on Rails site running on Linux and Apache. All of the resultingsettings are stored in a MySQL database. A user can have one or morerules in effect for the system to work, and one or more contactmethodologies for it to contact him or her. So, a user may, for example,configure the system to not allow postings about vacations more than acertain distance from home unless the post is only viewable to his orher friends and family group but nobody else and to contact him or hervia email and Facebook message.

Once the user has authorized the application the system works asfollows. The user enters a status update on Facebook, through whatevermeans he or she accesses Facebook, such as a web browser, dedicatedclient on tablet, dedicated client on smartphone, etc. Upon submission,Facebook's internal mechanism either posts the data to a DSS URL or theDSS polls Facebook and sees the update. Since the DSS and Facebook arenot on the same server, TCP/IP communication over the Internet is usedwith standard HTTP or HTTPS (if encryption is enabled) to transmit thedata. The DSS receives the update along with associated user informationfrom Facebook, and scans it by applying natural language processing tothe text, seeking to see if the text violates any of the rules mentionedin the rule set. This includes searching via readily availablealgorithms for specific keywords, strings, regular expressions, patternmatching, and combinations thereof. Analysis can include looking atgeotag/check-in information, the actual text, metadata that comes alongwith pictures, and any other information visible, or invisible to users,that Facebook relays with the update. Combinations of strings may alsobe detected. So, for example, “pot” may not set off an alert unlesswords like “grow,” “smoke,” or related terms and conjugations appear inthe same quote, will not flag as an issue if the word “cook” or “stove”or other terms that indicate that the “pot” in question is not marijuanaappears in the text, but will appear if other indications (such as theresults of natural language processing algorithms) indicate that thecontent is referring to marijuana and not a cooking pot. Pictures may beanalyzed using a facial recognition algorithm, fleshtone detections (toohigh a percentage of fleshtones coupled with shape recognition canindicate sexual content), object identification algorithms, and otherimage processing technologies that are widely available. Likewisepicture captions, hashtags associated with it, comments associated withit, and other text-based content that comes along with it can beanalyzed to provide an indication as to whether the image isobjectionable.

As it runs through the list of rules, if the DSS finds that any rule isviolated it creates a message by concatentating into a long string therule's description information, threat explanation information, and theactual text that triggered the rule violation. The system then pulls therelevant user's contact preferences from the database and sends thatmessage string via any of the notification methods selected by the user.In our example, the user selected email—so the system transmits it viaSMTP—crafting a standard SMTP message to port 25 of the local SMTP mailserver—and sends a message for the user via the Facebook API and TCP/IPback to Facebook. Alternatively, the system leverages Google Mail(GMAIL) to which it communicates via SMTP over TLS using port 587 (perstandard RFC 3207) or SSL (over port 465) or an SMS gateway to which itsends communication via that gateways API and TCP/IP (e.g., a post to aspecific page on the gateway's HTTP server interface) for similarcommunication.

In this embodiment, users wishing to use the system need to authorizethe Facebook application—which they can do via Facebook or from a pageserved via Facebook that is branded to look like the application. Afterauthorizing the application the user sets up which rules he or shewishes to be in place, and with what parameters, as well as his or hercontact preferences.

In another embodiment of the invention, the DSS may run similar tostandard Internet Security packages (e.g., anti-virus packages), in thatthe user runs software on his or her computer and clicks “Scan Facebookfor potentially problematic items.” The system may then either: (a) loginto facebook as the user (via HTTP unseen to the user and polls theuser's Timeline and Wall which it scans post by post and friend byfriend and event by event, etc. for all (or some) Facebook content (b)logs into Facebook as the user (via HTTP unseen to the user and pollsonly items updated since the last scan) and does a similar scan on allnew items, or uses the API to poll and scan either the entire useraccount or just the updates. A report is presented to the user at theend of the scan of any problematic items with recommendations as to howto address—in a fashion very similar to scans for viruses on a computer.The embodiment of the DSS could be combined with a scan of Facebookwalls for bad links as already exists for the best mitigation for bothtechnical and human issues presented by social media.

In another example embodiment, the DSS could be implemented on anapplication-level firewall, or scanner of outbound data, where all databeing posted to social networks from all users on the internalnetwork(s) can be scanned and blocked if necessary. In this embodiment,the system would perform analysis of outbound data similarly to otherembodiments described in the specification, but would occur at thegateway and leverage the existing communication channels of an app-levelfirewall or scanner of outbound data—which today scan for other types ofissues, but not numerous types of items that can have negativeconsequences on people and organizations as described elsewhere in thisdocument.

In another example, a user may run DSS software on his computer, such asa desktop, laptop, server, tablet, smartphone, embedded system, or anyother form factor for a computer. The software may be an independentapplication, a web application, or it may be provided as a service by aSaaS provider. The user provides the DSS software with login credentialsto his various social media accounts, or social media repositories, andthe DSS logs in to these sites, scans the sites, and produces a reportfor the user of potential issues for him to address together with anexplanation as to what may be problematic about each discovered item ofinterest, and optionally provide a link or other address for each item.The scanning may be run manually, at specific intervals based on time ina fashion similar to the way many anti-virus scans are run, inconjunction with a scan for rogue links on a Facebook wall, or usingsome other scheduling system. The user may address these issuesindependently of the DSS, or with some automated assistance as describedin the preceding example.

FIGS. 14-16 illustrate various processes employed by the DSS in thecontext of server-based, local, and distributed embodiments. FIG. 14 isa flowchart illustrating one of many possible server-based embodimentsof the DSS. At 1400, a data upload, such as the sharing of a text post,photograph, or video is attempted by a user. At step 1410, the DSSserver receives the data attempted to be uploaded by the user. At 1420,the server determines the type of data attempted to be uploaded, such astext, geographic location, images, video, audio, or other type. At 1430,the server executes appropriate scanning routines, by employing, forexample, one or more of the recognition modules described in FIG. 12 andaccompanying text. At 1440, the server compares data and/or results ofthe data scan routine with available rule sets. Based on the performedcomparison and available rules, the server may then reject the data(step 1450), present the user with a warning and options (step 1460),publish the data or make it publicly available as requested by the user,or in some modified form (step 1470), or notify a system administrator(step 1480). It should be noted that one or more of the steps describedabove, such as steps 1430 and 1440 may be merged into a single processor step for improved efficiency or other implementation reasons.

FIG. 15 is a flowchart illustrating one of many possible localembodiments of the DSS. At 1500, a data upload, such as the sharing of aphotograph is attempted by a user. At 1510, the DSS or a DSS moduleintercepts the data requested to be uploaded by the user. At 1520, thelocal DSS implementation determines the type of data attempted to beuploaded, such as text, geographic location, images, video, audio, orother type. At 1530, the local DSS implementation executes appropriatescanning routines, by employing, for example, one or more of therecognition modules described in FIG. 12 and accompanying text. At 1540,the local DSS implementation compares data and/or results of the datascan routine with available rule sets. Based on the performed comparisonand available rules, the local DSS instance may then reject the data(step 1550), present the user with a warning and options (step 1560),upload the data as requested by the user or in some modified form (step1570), or notify a system administrator (step 1580). As before, itshould be noted that one or more of the steps described above, such assteps 1530 and 1540 may be merged into a single process or step forimproved efficiency or other implementation reasons.

FIG. 16 is a flowchart illustrating one of many possible distributedembodiments of the DSS. At 1600, a data upload, such as the sharing of aphotograph is attempted by a user. At 1610, the DSS or a DSS moduleintercepts the data requested to be uploaded by the user. At 1620, thelocal DSS instance determines whether data scanning modules are local orserver-based. If the data scanning modules are server-based, at 1625 theDSS instance sends data requested to be uploaded, together withancillary data and metadata to the server for further processing. If thedata scanning modules are local, at 1630, the local DSS implementationdetermines the type of data attempted to be uploaded, such as text,geographic location, images, video, audio, or other type. At 1640, basedon the data type, the local DSS instance determines whether appropriatescan modules, such as an Image Recognition Module appropriate for aphotograph, are local. If the appropriate scanning module is not local,at 1645 the DSS instance sends relevant data, together with ancillarydata and metadata to the server for further processing. If theappropriate scanning module is local, at 1650 the local DSS instanceexecutes the appropriate data scan routine employing, for example, oneor more of the recognition modules described in FIG. 12 and accompanyingtext. At 1660, the local DSS instance determines whether rule sets arelocal. If rule sets are not local, at 1665 relevant data, together withancillary data and metadata to the server for further processing. Ifrule sets are local, at 1670, the local DSS implementation compares dataand/or results of the data scan routine with available rule sets. Basedon the performed comparison and available rules, at 1680 the local DSSinstance then takes action with respect to the data requested to beuploaded by the user. As before, it should be noted that one or more ofthe steps described above, such as steps 1650 through 1670 may be mergedinto a single process or step for improved efficiency or otherimplementation reasons. Furthermore, in other embodiments, the DSS mayskip certain of the steps illustrated above instead of performing theoperation locally or sending data to a server for further processing.One of ordinary skill in the art would recognize that the stepsillustrated above may be performed on the mobile device, server, orother computing device, depending on the implementation of the DSS. Thepurpose of FIGS. 14-16 is not to limit the invention to a particularconfiguration, but rather to illustrate the flexibility of theinvention.

Scanning

As previously introduced, scanning refers to the process or mechanismfor detecting various, potentially harmful, items of informationrelating to a user that are about to be, or have already been, postedonline. Scanning may be implemented using one or more modulesillustrated in FIGS. 11 and 12. From an implementation and configurationperspective, scanning may be done in real time as a user entersinformation into a social media site; in batch mode; constantly; whencontacts are added; when specific actions are taken; when events areviewed or agreed to; when a user confirms information; when profileinformation is added or modified for the user or for a contact; when acommunication is received; in a combination of the above, or based onother triggers.

Furthermore, the DSS can be configured to scan only when a user makes anupdate or is notified of an update (so that it would address both postsmade by a user as well as posts made by others' linking or tagging tothe user). For example, if a user X posts a comment on user Y's Facebookwall, Facebook notifies user Y that a comment has been posted. In oneembodiment, the DSS sees the notification and scans the comment as wellas the original post and all other comments on it, including any links,images, or other attachments. In this example, the DSS accesses its rulesets, and determines that the user wants to be prompted to considerremoving this type of comment—but not the original post or othercomments, and the user wants this prompt via a message in his Facebookaccount as well as via a text to his cellphone. The DSS complies andsends the Facebook and text messages. The user can then reply to themessage with a command to remove it, manually remove the offendingmaterial, or leave it, among other options.

In one example of scanning, the DSS would scan a user's Facebookprofile, friend list, settings, wall and/or timeline and/or newsfeedtagged items, such as photos, videos, posts, and comments, by otherusers as well as the user, any specific hashtags selected for scanning,and any other items on Facebook related to the user for potentiallyproblematic items. Depending on the rules that the user has accepted aspart of his or her configuration, and based on the actions the user hasset for those rules, the invention might, for example, flag a post aboutthe user picking up his daughter at day care as risky and prompt theuser what to do with it. Based on the scan, the DSS might remove auser's comment that contains a vulgarity as well as send a message tothe user who used the vulgarity (via private Facebook messaging, forexample) that the comment was removed automatically by the DSS due tocontaining vulgarity and that he or she is invited to both re-commentwithout the vulgarity as well as utilize the invention for his ownsecurity. In another example of scanning, the system may note that acheck-in, posting, or a photo that the user has posted (e.g., withgeotagging or with images of recognizable places), is showing the user1,000 miles away from home and taken on the day of the posting and warnhim that it may be safe to post this once he has returned home ratherthan while away (or may automatically delay the post until the user“checks in” or notes that he is back home or closer to home), whileallowing without warning a check-in, posting, or photo taken 1,000 milesaway but taken two days earlier when the user has already made postingsfrom home again. In other examples of implementation, if a user attemptsto post something controversial, the DSS may warn him before allowingthe post to even be made—not just by scanning reactively, but alsoproactively preventing “bad” materials from ever appearing in the socialmedia altogether. Of course, numerous other items may be scanned for andaddressed by the DSS on Facebook, Twitter, Instagram, SnapChat, Tumblr,Pinterest, Foursquare, Google+, and other social media sites, asdiscussed in the rules section below. Likewise the invention can be usedto scan blogs—the posts and associated comments—and other forms ofquasi-social-media for the same types of issues as exist with “pure”social media.

In the preferred embodiment, the DSS is capable of scanning not onlymessages and other information shared by the protected user, but also,as introduced earlier, but also scanning of messages and otherinformation shared by another user that may impact the protected user.In other words, the DSS may be configured to scan all social media, andother publicly available information, that implicates the protecteduser, and not just comments posted by the protected user. Furthermore,the DSS may be configured to expand its scanning profile to includeitems that by themselves do not trigger any of the set rules, such as,for example, by noticing that a large number of objectionable commentswere caused by a seemingly innocuous original post.

In another embodiment, the DSS would enable a user to remove somethingthat may cause a problem for User X—even though User X may have noauthority to remove it on his own. This might be a photo showing User X,for example, but in which he is not tagged. In another embodiment, ifthe DSS is incapable of causing removal of the photo, the DSS wouldenable a user to request the poster, or the hosting site, or service toremove the photo. As explained earlier in connection with therecognition modules in FIG. 12, such a photograph could be found usingcommercially or specifically developed technology for face recognition(e.g., by leveraging existing facial recognition technology andalgorithms), which may be used in combination with the spideringmechanism described below.

FIGS. 17-19 illustrate several embodiments of the DSS as implemented inrelation to social media. FIG. 17 is a flowchart of steps taken by oneembodiment of the DSS that is implemented separately from the socialmedia provider. In step 1700, a user enters data into social media, forexample by submitting a message in the Facebook app on a mobile deviceor through the Facebook website. The social media provider (Facebook inthis example) posts, or publishes, the user's message in step 1710. Insteps 1720, 1730, or 1740, the DSS, which in this embodiment is runningon a computer server, receives notice of the user's post. The DSS may benotified via the social media provider's API in step 1720, by pullingdata from the user's social media account in step 1730, or othernotification mechanism in step 1740. The DSS then analyzes the user'sposted data in step 1750, and compares it against relevant rule sets instep 1760, possibly by employing the architecture illustrated in FIGS.11 and 12. As noted earlier, the rule sets may include patterns thatwill be scanned for by DSS's recognition modules illustrated in FIG. 12.If a rule is violated or triggered in step 1760, the DSS warns the userin step 1770. Otherwise, at step 1780, the DSS does not warn the userdoes not interrupt the user's activities.

FIG. 18 illustrates one embodiment of the DSS which has been integratedinto a social media provider. Here, as the user starts typing text instep 1800, the DSS begins scanning the typed text in step 1810, andcomparing it with relevant rule sets in step 1820, possibly by employingthe architecture illustrated in FIGS. 11 and 12. As noted earlier, therule sets may include patterns that will be scanned for by DSS'srecognition modules illustrated in FIG. 12. If a violation or triggeringof a rule is detected in step 1820, the DSS warns the user in step 1830.If no violation is detected, the DSS determines whether the user isstill typing at step 1840, and if so, goes back to step 1810 to scan thetyped text. If the user is no longer typing after no violation wasdetected in step 1850 (e.g., the user pressed ‘enter’), the DSS does notwarn the user. Depending on the implementation, this scanning method maybe employed and repeated after every character, word, sentence,paragraph, or other metric, beginning after a specific number ofcharacters, words, sentences, etc. have been typed. The benefit of thisembodiment is that the user is warned of potential issues before he orshe even hits the ‘submit’ button in the social media app.

FIG. 19 illustrates another embodiment in which the DSS has beenintegrated into a social media provider. Here, the user enters andsubmits text in a social media app or via a website at step 1900. TheDSS scans the submitted text at step 1910, and if a violation ortriggering of a rule is detected at step 1920, the DSS warns the user atstep 1930. If no violation or triggering has been detected, the DSS doesnot warn the user and his or her activities proceed uninterrupted. Itshould be noted that the user warnings in FIGS. 17-19 may be more thansimple warnings, as described herein. The warnings may include otheroptions, such as Ignore, Modify, Remove, and others options describedherein.

The following are several examples of the DSS as it may be implementedon several major social media sites.

As one example, the DSS may scan a user's Pinterest, Instagram, or otheraccount and check for controversial images and text. For example, apolitical cartoon may be detected and the user warned if the user has arule that political cartoons should be addressed via a warning. Scanningcan determine this by looking at album names, board names, captions,etc. or by recognizing the image by matching it with others or throughheuristic analysis. The DSS may scan for copyrighted materials and checkthat the user has not PINned any items that the owner does not wantPINned by others.

In another implementation, the DSS may check a Twitter or LinkedIn feedfor posts of a potentially problematic nature. Many of the examplesdisused earlier in relation to Facebook would apply here and more arediscussed in the rules section below. For example, depending on theuser's configuration choices, as discussed earlier, links tocontroversial sites, pages, and the like, may be detected and flagged.Postings that the user is at a specific location may be flagged. As theuser attempts to make a new post, it may be examined and addressed inreal time as described earlier as well. In the case of LinkedIn,connections to new parties at the same firm may indicate to others aboutpotential business activity with that firm.

Also, in the case of Twitter—any tweet message that the user receives(e.g., a tweet that mentions the user's @name) may be checked by theDSS—and any text, links, images, or videos in it or linked to it checkedso that the user can be notified of any problems prior to replying. Ifother users are flagged in it with their @names checks could be done onthose user accounts. Furthermore, as described with respect to Facebook,the sender's earlier posts, photos, videos, and links can be checked tohelp the user ensure that he is not getting involved in a publicdiscussion with someone controversial. For example, if images that thatuser posts have been flagged as potentially graphic by twitter, perhapsthe user does not want to reply, so the DSS will address this issueaccording to the user's settings. The DSS may take a similar approach ifanother user's profile contains information that would make the otheruser likely not someone with which the DSS user wants to be publiclyassociated. It may scan a list of the users following the user beingsecured by the DSS, and may scan the list of all users he or she isfollowing—with the goal of finding controversial users, problematicusers, and/or phony users. Names, Twitter handles, and words and phrasesin the user descriptions of these users may be scanned as well. All ofthe decisions as to what to check, how to handle, whether to apply rulesto other users' data, etc. are potentially configurable by the user or aDSS administrator.

Foursquare check-ins would also be checked against rules if the user sodesires. The user may allow check ins within a certain distance from hishome, for example, but not far away since that could instigate break inattempts. Other stricter or more lenient policies (rules) could also beset up by, or for, the user (or by a business administrator, in the caseof a business implementation of the DSS which is propagatingconfiguration and rules to users as is discussed elsewhere in othersections of the specification).

Posts to gaming sites would be similarly addressed—especially the feedswhich contain user to user and user to group dialogue. Likewise, sitesof potentially controversial groups, firms, products, organizations, andother entities, would be addressed. It should be noted that in thespecification and drawings, controversial does not necessarily includeonly things that are controversial on a macro scale, but also thosecontroversial on a micro-scale. For example, things that are notcontroversial for the average American, may be controversial for membersof a specific religious order, ethnic background, or other group, thingsthat are not controversial for the average person may be controversialfor an employee of a specific company, etc. In other words,controversial content or actions may be harmful to the DSS user, or theymay be harmful to someone else. Circumstances that allows data to leakthat may lead to a negative consequence for the user of the DSS may beinherently controversial or problematic.

In other embodiments, the DSS scans security settings on social mediasites as well as profile information for a user, along with the user'sLikes (in the case of Facebook) for potential issues, as well as theirFriend list for potential issues (in the case of Facebook), Contacts inthe case of LinkedIn, their followers and those they are following inthe case of Twitter, and similarly all parties who are connected withthem in the case of other social media platforms. A user who has Likedsomething controversial should be warned. Events that a user has beeninvited to (whether accepted, rejected, or not) may also be scanned—asevents can lead to increased chances of break ins, controversialactivity, undermining claims made in lawsuits, disability or workerscompensation applications, or put the user at risk of being mugged(e.g., a user who says he is attending a particular jewelry show at aparticular time on a particular date may expose him or herself to amugger knowing to follow the user afterward).

FIG. 20 illustrates one embodiment of a user notification. In FIG. 20, auser attempted to post about his or her daughter's first day of school.The DSS, pursuant to a configured rule set, determined that the textualpost poses a concern. In FIG. 20, the DSS presents the user with thetext of his or her attempted post; the current status of his or herprivacy settings (which happen to allow anyone to view the user'sposts); and what the potential concern is with the user's post (that thepost will tell anyone in the world where the user's daughter goes toschool). The DSS also presents the user with four selectable options:POST ANYWAY; EDIT POST; CHANGE PRIVACY SETTINGS; and CANCEL POST. One ofordinary skill will recognize that many other warnings and notificationsare possible, both from the perspective of rule sets and also from theinterface perspective.

Turning to the computer-based implementation of the scanning process,FIGS. 11, 12, and accompanying text describe several embodiments ofcomputer architecture capable of supporting scanning operations. One ofordinary skill in the art will recognize the existence of many knownalgorithms for analyzing text (which in the context of the DSS mayinclude posts, comments, photo and vide captions, profile data, andother representations), including numerous semantic processingalgorithms, Natural Language Processing algorithms, and various forms ofpattern matching and pattern recognition. Any one or more of them may beused in an implementation of the DSS. Further, performing scans forcertain keywords, phrases, and applying contextual analysis whennecessary, are all examples of scanning that may be employed by the DSS.Moreover, scanning for specific settings in various social mediaplatforms may also be achieved, for example by simulating web or mobileaccess to those settings or polling them directly from a social-mediaapp. As described earlier, users or administrators will be able toconfigure which keywords they care about, as well as topics and concepts(which could be converted to keywords and natural language analysis bythe one or more modules of the DSS or by an ancillary apparatus orprocess). For example, if a user selects a “no sports” pictures setting,the DSS would know to look for terms like “baseball,” “football,” or“hockey” in its textual and OCR scanning.

As described in the previous paragraph, techniques for computerunderstanding of human text are well known and widely available.However, in certain embodiments, the present invention builds on thosetechniques by applying language analysis to comments and posts that linkto the protected user's posts; link to posts about the user; or thatreference the user to determine the possible problems with priorcomments and the original post. For example, if a user posts a photo ofhimself at a party with several unnamed and untagged people, and one ofthe comments says “Wasn't so-and-so just arrested for running a Ponzischeme” then the DSS may not only flag the comment, but the originalpost as well, and depending on the settings would warn the user not justabout the comment, but about the photo itself, since the photo may beshowing him with a known criminal, possibly also allowing the user theoption to remove the photo.

Another aspect of the present invention is the ability to provideoversight capability to certain people, such as parents, companymanagement, and system administrators, referred to as overseers herein.In implementations involving overseers, the person being overseen isreferred to as a user for the purpose of differentiating the two, eventhough both the ‘user’ and the ‘overseer’ derive benefits from the DSS.In oversight implementations, the DSS is capable of providingnotification services in a variety of ways, including:

-   -   notifying only the user, but not the overseer;    -   initially notifying only the user, but if the user does not act        on the notification within a specified time period, also        notifying the overseer;    -   initially notifying only the user, but if the user does has        previously not acted upon notifications (the number of        notifications and length of the time period being configurable        by the overseer/organization implementing the invention), also        notifying the overseer;    -   notifying only the user unless the rule that triggered the        notification is specifically flagged for notifying the overseer        (as could be the case if something especially problematic is        detected—for example, if the user accidentally posted quarterly        figures before the official announcement, certain actions may be        required of the business by law, and the business would want to        know about what happened);    -   notifying both the user and overseer—for example, if the        monitored account is an official business account, the business        would want to receive notifications for that account as well as        the employee user of that account. Similar considerations would        apply to an official Twitter feed for “Business X's CTO” for        example, which is used for thought leadership and updates        related to technology at Business X;    -   notifying only the overseer, for example in the event that        potentially criminal activity is detected; and/or    -   a combination of these types of rules depending on the group the        user belongs to and the type of user, where, for example, the        configured rule policies may be different for the CTO than for        the mailroom clerk.

One of ordinary skill in the art would recognize that numerous ways ofnotifying users, overseers, and administrators of the DSS are possible,including email; text message; message via a social network; by color orpattern coding messages, posts, and other indicators in their socialmedia; phone call; voice message; by color or pattern framing images orvideos within their social media; including icons or labels near posts,messages, pictures, videos, sounds within their social media, pop-upscreen, vibration, or by other mechanism.

The DSS may be configured to perform Predictive Scanning; that is,scanning that is not based on a pre-defined and static set of rules, butscanning based on the ever changing landscape of publicly availableinformation and threats. As one example of our changing threatenvironment, in the 1990s it was fairly common to find social securitynumbers on various documents like pay stubs, and credit card numbers onreceipts. At the present time, however, seeing one of those numbers on apublic printout would be seen as a major blunder, and action would betaken to eliminate the printout as soon as possible. In this scenario,Predictive Scanning would constantly update its definitions to findevolving threats. In some embodiments, Predictive Scanning would work inconjunction with spidering, described in more detail below. One ofordinary skill in the art would recognize that numerous algorithms existfor performing adaptive, or predictive, tasks, such as neural networks,radial basis functions, support vector machines, Bayesian processes, thenearest neighbor algorithm, and geospatial predictive modeling. Thislist is not exclusive; rather, it provides some examples of methods thatmay be used to implement Predictive Scanning functions of the DSS.

Spidering

Some embodiments of the present invention may implement a capabilityreferred to as spidering herein. Spidering refers to methods ofsearching for, and possibly collecting, information relating to a userthat may be available from social media and other sources on theInternet or locally. The following embodiment of spidering is presentedhere in the context of Facebook but applies to all social media in asimilar fashion. In spidering, the DSS would scan all of a user'smaterial, all of his friends material, all of his friends' friendsmaterial (and so on), to the extent the content is available, in orderto find any references to the user or any content that relates to theuser. The content so scanned is compared against the configured rulesets, and determined whether violations or triggers occurred. If thecontent cannot be edited or removed, messages may be sent to the userswho own the content asking them to remove/modify it and offering themthe services of the invention to secure themselves as well. Preferably,the user would also be notified of the results and be offered theability to address them as well. Such messages could identify themselvesas auto-sent by the DSS, even in cases in which approval needs to begiven by the user after the system finds the need to send the messagesvia applying the rules. The user, either through some console interface,an app, or by replying to messages sent by the DSS by email, messaging,within Twitter message/tweet, Facebook message, or outside social media,could approve the sending of the messages to the other parties.

Further, in some embodiments, the present invention enhances security bytaking into account current events. Since social media users oftendiscuss current events, the DSS may be configured to focus particularattention on items of current events that may be controversial. Forexample, the DSS may access a server that contains information aboutcurrent events with information about what might be controversial. Forexample, social media posts from June of 2012 regarding George Zimmermanand Obamacare are likely to elicit strong opinions, and therefore termsand words associated with these stories found within a user's posts orcomments or comments on his or her posts might indicate a conversationthat should be monitored for controversial material. While the DSS maymaintain this information long-term for scanning, it is likely that amajority of the posts associated with controversial current events willappear shortly after these topics appear in the news. Furthermore,opinions are likely to moderate, and tempers less likely to flare asmuch, as time passes. Accordingly, for ‘controversial current events’the scanning engine is preferably configured to have these variables(and rules) moved high up on the list in the short term, and lower downin the long term. Of course, users can configure which of these keywordsthey care about—so on the first warning, for example, about apotentially controversial posting about George Zimmerman, a user mayclick “IGNORE ALL” (rather than “IGNORE THIS POST”) and the system willbegin to IGNORE all posts he makes about that topic. Similarly todefault configurations regarding standard DSS rule sets, the currentevent services may have default rules of their own. The potentialproblem of posts relating to current events similarly applies tobusinesses and other organizations, and also because the business mayneed to prevent certain content from appearing on social media during aspecific period. For example, it may be fine for employees to discusscompany X during ordinary times, but not during a potential acquisitionof company X. Accordingly, the DSS may be configured by systemadministrators to reject, or delay, the posting of content relating tocompany X by employees.

In another embodiment, the DSS may assist social media providers tobetter secure their users by preventing them from making bad suggestionsto their users. For example, people who are arrested possibly should notbe suggested as Friends to people the next day. The same type of serverthat has info about current events could also contain an updated list ofpeople not to suggest as friends or contacts—or could send thisinformation down to the clients on smartphones and computers if suchclients are used in that implementation of the invention. If theinvention is running as a social media app it can interface with theserver constantly. This, and similar, functionality, provided by the DSScould be offered by social media providers for individual users, forparents overseeing children, for businesses, organizations, and otherentities overseeing employees, partners, and others. Likewise, DSSfunctionality could be adopted by Internet security software companiesand anti-virus companies to enhance their social media scans whichcurrently detect just malware and bad links.

Rule Sets

One aspect of the present invention involves “rules” that guide thesecurity system at several stages of its operation. Multiple rules aresometimes referred to as “rule sets” in the drawings and accompanyingtext. In one embodiment, rules establish criteria for the setup andoperation of the DSS. In another embodiment, rules set forth whichonline platforms should be scanned, and how. In another embodiment,rules may be viewed as variables and indicators to scan for when lookingfor potential issues. In another embodiment, rules provide how toaddress occurrences of issues and content containing those issues. Rulesmay be established by users of the DSS, overseers described above, orsystem administrators. The details of system configuration are describedin greater detail below. However, in the preferred embodiment, the DSScomes pre-equipped with a default set of rules, or multiple sets, thatmay assist users in configuring what the system should scan for, and howto handle occurrences of relevant content.

In one embodiment, the DSS receives updates to rule sets from othercomputers and databases (for example, by receiving an updated list ofnames of people arrested for pedophilia—which may be scanned for if theuser a warning if any of his ‘Friends’ on Facebook have been arrestedfor such a crime and letting him decide whether to unfriend or not), ornew rules that may be used to enhance scanning capabilities may bestored on a computer elsewhere as is common with modern-day apps andapplications.

In order to safeguard users and organizations from potentiallyproblematic information appearing online or on social media, in thepreferred embodiment the DSS analyzes information from various sources,and where appropriate, draws conclusions from its analysis. The DSS ispreferably capable of accessing various sources of information,including websites, FTP sites, databases, network repositories,messaging services, data sharing services, data transmission services,and any other electronically accessible resource capable of providinginformation. One of ordinary skill in the art would recognize thatinformation available from various sources may exist in numerous dataforms, including audio, video, images, text, database objects, databaseentries, data collections, computer readable data, and human readabledata among others. In the preferred embodiment, the DSS is configured toanalyze some or all of the various forms of data listed above, anddetermine whether the analyzed piece of information, together or incombination with other pieces of information, may cause a problem to anindividual, organization, or object. Items of pertinent informationthat, in some embodiments, are analyzed by the DSS, may includeinformation relating to human beings (such as their names, nicknames,visual appearance, weight, voice, age, location, sex, education level,title, patterns of behavior, preferences, medical history, life history,family relationships, residence, travels, and other data), ororganizations (such as their names, abbreviations, associations,ownership, industry type, activities, products, services, management,age, governance, political activities, market presence, geographicpresence, employees, and other data). These items of information are notprovided as an exclusive list—rather, they are provided as anillustration of different types of data and information that the DSS mayanalyze while safeguarding users from potentially problematic ordangerous information being posted online or on social media. One ofordinary skill in the art will recognize that information of any sort,including images, video, audio, textual content, contextual data,geographic data, location, proximity, movement, chronological data,time, date, metadata, various data patterns, encrypted data, socialmedia actions, user actions, user inaction, user selections, useromissions, patterns of user behavior, or the appearance of any of theabove, may, in certain situations pose problems to an individual ororganization if publicly disclosed. Further, in some embodiments, theDSS may be configured to detect connections and/or relationships betweendistinct types of information, further improving its ability to detectthe existence of problematic information. Therefore, the DSS need not belimited to analyzing a single piece of information, or a collection ofhomogenous pieces of information, but can rather build a morecomprehensive picture that reveals problems that cannot be detected byfocusing on a single data point.

Below is a list of numerous situations for which the DSS may beconfigured to scan for, analyze and address. These situations includehuman and organizational actions, movement, content, posts, and otheritems of information and data (collectively referred to as variables orindicators) which, if became public, could cause problems to a user ororganization. Appropriate rules for how to handle instances of apositive scan for these variables, or the discovery of an indicator, canbe made by the user, administrator, overseer, or any other person withaccess to configuration parameters. Each item listed below can be usedby itself or in combination with others. This list is not intended to becomprehensive or exhaustive, but to provide some examples of situationsthat can be addressed by the DSS, and rules that can be set up to guidethe DSS in its functions. Other examples appear throughout thisspecification. Each occurrence of a variable or indicator listed below,may be addressed by the DSS pursuant to one or more rules, for exampleby deletion, quarantine, modification, ignoring, performing an actionthis time only, performing one action this time and a different actionnext time, addressing and notifying all parties involved, as well astaking other actions disclosed earlier. Unless stated otherwise,‘address’ in the following examples refers to taking action in responseto a positive identification of a variable or indicator being scannedfor (i.e. finding content that triggers a response) based on certainpre-configured rules.

-   -   Any references to numbers that are in the form of a social        security number, credit card number, etc. Scan for relevant        information, analyze, and address.    -   If a user notes that he was at a particular financial        institution, that information might assist someone attempting        financial fraud against the user. Scan for relevant information,        analyze, and address.    -   If a person posts photos of children that are geotagged, that        information might assist a kidnapper. This includes any postings        that don not have technical geotagging but which contain        information about where the kids go to school, afterschool        activities, etc. Scan for relevant information, analyze, and        address.    -   If a user's privacy settings allow anyone to see their media        that might increase all sorts of risks. Scan for relevant        information, analyze, and address.    -   If a user is posting family related material and allows        non-family parties to see that might lead to issues. Scan for        relevant information, analyze, and address.    -   If a person mentions schools, camps, day care, or other youth        programs that his/her children, or other children with whom he        or she is associated, attend, that information may increase the        risk of a kidnapper or pedophile targeting these children, or        allowing other criminals to ascertain his or her schedule and        rob his or her house or office. Scan for relevant information,        analyze, and address.    -   The name of schools that someone attended are sometimes used for        bank logins. Scan for relevant information, analyze, and        address. In this case and in all others addressing may mean to        limit visibility to some users and not others. The rule may        apply to different people, groups, or entities differently.        Further, where appropriate assign multiple levels of risk and        address the different levels accordingly.    -   Type, make, model, and color of someone's first car is often        used by financial institutions as part of a login process. Scan        for relevant information, analyze, and address.    -   The name of one's best man or maid of honor, pet, first pet,        mother or father's middle name, mother's maiden name,        grandparents' names, parents' birthdays are sometimes used by        banks as passwords. Scan for relevant information, analyze, and        address.    -   Similarly, “questions” are sometimes used for authentication and        login purposes, but the answer can often be found in social        media that a person or entity has shared. Scan for relevant        information, analyze, and address. In one embodiment, the DSS        secures by addressing any item that is used as part of        authentication questions (i.e., challenge questions) that can be        discerned from social media directly or indirectly by either        modifying it, removing it, quarantining it, limiting its        exposure to parties that pose no risk or already have the        information, or allowing the user to do with it what he wants        after making him cognizant of the risks inherent is sharing this        information. Other examples of this would first girlfriends        name, name of your college, place of first kiss, mascot of high        school or college, etc.    -   If a person mentions schools, camps, day care, or other youth        programs that his/her children—or other children with whom        he/she is associated—with information that may indicate the time        that the child arrives at or leaves the facility attend that may        increase the risk of a kidnapper or pedophile targeting these        children, as well as may help criminals break into the user's        home. Scan for relevant information, analyze, and address.    -   If a person mentions schools, camps, day care, or other youth        programs that his/her children—or other children with whom        he/she is associated—with information that may indicate the time        that the child arrives at or leaves the facility as well as the        time that the parent is away, this may increase the risk of a        kidnapper or pedophile targeting these children, or may make a        potential burglar aware of a time window during which the user's        home or someone else's home may be empty thereby making it a        good burglary target. Scan for relevant information, analyze,        and address.    -   If a person indicates anything about a child's school or camp        trip that may increase risks to the child. Scan for relevant        information, analyze, and address.    -   If a person posts pictures of teenagers engaged in activities        that are inappropriate (or even illegal for people under a        certain age). Scan for relevant information, analyze, and        address.    -   If the user notes that he is in some particular location for        example by “checking in” by geotagging it, by mentioning it, or        by photographing it, and that location is far from home that        might indicate that the user's home is empty which could be a        sign for criminals to break in. Scan for relevant information,        analyze, and address.    -   If in the aforementioned example, the user mentions their family        being away, or has a family photo at such a location, or the        location is normally associated with family vacations (e.g.,        Disneyland), the risk may be greater. Scan for relevant        information, analyze, and address.    -   If the user notes that they will be attending an upcoming event        that may provide an opportunity for user for a criminal to        attempt to break into their home when the user is away. Scan for        relevant information, analyze, and address.    -   If the user posts information about his or her schedule or        someone else does that may provide criminals with information        that may help with break ins, social engineering, etc. Scan for        relevant information, analyze, and address.    -   If a user posts information about passwords, account numbers, or        other confidential information. Scan for relevant information,        analyze, and address.    -   If the user was injured and is making a claim, such as workers'        compensation, disability, or lawsuit, and posts material that        could be used—or misused—to dispute the validity of that claim.        Scan for relevant information, analyze, and address.    -   If a user mentions that he she has broken the law, including        motor vehicle offenses. Scan for relevant information, analyze,        and address.    -   If a user is pictured or mentioned with alcohol or cigarettes or        some other sort of activity that may be legal but not viewed in        the highest regard. Scan for relevant information, analyze, and        address.    -   If a number appears that seems to be a social security number or        its last four digits (e.g., XXX-XX-XXXX or is four or nine        digits and appears in close proximity to the words “social        security”), or a credit card number (four sets of four digits,        sixteen digits—or in the case of American Express 15 or        XXXX-XXXXXX-XXXXX) Scan for relevant information, analyze, and        address.    -   If inappropriate language or tone is detected. This may also        include words that the invention determines are inappropriate        within certain contexts via natural language processing. For        example, calling a donkey a donkey or ass might be fine, but        calling a person the same is probably not. Scan for relevant        information, analyze, and address.    -   If people are in some state of undress that may be        controversial. This can be detected not only from photos (via        skin tone detection) and photo captions, but from keywords as        well. Scan for relevant information, analyze, and address.    -   If names of people the user does not want to think about or        associate with—address. Scan for relevant information, analyze,        and address.    -   If the user is under the minimum age for smoking or drinking and        such words appear in a description, or a photo is analyzed and        shows such activity. Scan for relevant information, analyze, and        address.    -   Photographs or text mentioning potentially controversial items        could create issues for a user—what may be controversial in some        contexts may not apply to others (e.g., guns, drugs, alcohol,        religious practices, sexual practices). Scan for relevant        information, analyze, and address.    -   People may not want to be associated with criminals or people in        the news for various nefarious activities. Scanning a user's        friends list and comparing to names in the news (either via a        news search site, a news site, or via a special current events        server as part of the invented system), criminal lists, etc. may        be useful. Scan for relevant information, analyze, and address.    -   Users privacy settings should also be verified to ensure the        information is only displayed to people that the user intends        to. Scan for relevant information, analyze, and address.    -   If user is undergoing a divorce—anything that may impact should        be checked for—comments about other women, pictures with other        women, comments about his soon to be ex-wife, etc. Scan for        relevant information, analyze, and address.    -   If a user is applying for job, or has a job with a firm—mentions        of that firm or competitors could be problematic. Scan for        relevant information, analyze, and address.    -   Comments about one's co-workers or boss (or former co-workers        and formers bosses) can also become issues. Scan for relevant        information, analyze, and address.    -   Negative posts about a person, organization, etc. could be        problematic as they could become grounds for a defamation or        libel lawsuit. Scan for relevant information, analyze, and        address.    -   Anything about any form of medical condition or presence in the        hospital or at a particular doctor could disclose medical        information about the user or a close relative or friend. Scan        for relevant information, analyze, and address.    -   Scanning the user's friends—if there is a disproportionate        number of people with the same last name (meaning whatever last        names occur the most among the users' friends, followers, etc.)        or some sort of identical name that may indicate that this is        the user's mother's maiden name which may be used as a password        elsewhere. Scan for relevant information, analyze, and address.    -   If the user's location is changing rapidly and his GPS location        shows he is on a road—he or she may be driving. Scan for        relevant information, analyze, and address.    -   In many cases it is best that only relatives be able to see the        relationship between people from a familial perspective because        various questions about familial relationships may be used for        passwords. Check if this is not the case with the user's        settings in his social media account/s. Scan for relevant        information, analyze, and address.    -   Compliance risks—in certain industries a person's communication        may be regulated. For example, a stockbroker's postings about        stocks might be regulated. If the user has configured his        profession the invention can optimize such scanning, but, even        without it can scan for keywords and phrases as well as use        natural language analysis to prevent problems. Scan for relevant        information, analyze, and address.    -   Scanning for stock or financial related advice, medical advice,        or legal advice, and perhaps other forms of advice and        suggestions may be indicative of user actions or intentions.        Detection may prevent potential civil or criminal issues if        people follow such advice. Scan for relevant information,        analyze, and address.    -   Comments that are vulgar, facetious, etc. Scan for relevant        information, analyze, and address.    -   Photographs of the user in certain environments (e.g., certain        clubs and venues) could be problematic. Scan for relevant        information, analyze, and address.    -   Religious observances and other sensitive activity may also be        flagged. Scan for relevant information, analyze, and address.    -   Posts that contain certain terms and/or phrases—for example        those related to terrorist groups, extremist groups, certain        political groups, certain types of munitions, may lead to an        increased likelihood of government snooping, monitoring, or        other invasions of privacy. This is especially true in the        aftermath of terrorist attacks and other events that incentivize        governments to perform surveillance. Scan for relevant        information, analyze, and address.    -   Photographs, comments, videos, or postings that indicate that        the user is a member of a particular organization to which the        user may or may not wish everyone to know that he is a member.        Scan for relevant information, analyze, and address.    -   If the user is a party to a lawsuit a warning should be made in        general, and anything related to the suit is potentially        problematic. When the system initially starts up it can ask the        user if he is party to any lawsuits, what his profession is,        etc. He does not have to answer—but providing the DSS with such        information can help it help the user. Scan for relevant        information, analyze, and address.    -   Profanities (in any language) should be flagged. Scan for        relevant information, analyze, and address.    -   Same with other forms vulgarities. Scan for relevant        information, analyze, and address.    -   If an image, video, string of text, link, etc. is copyrighted        (explicitly or implicitly). Scan for relevant information,        analyze, and address.    -   If an item is copyrighted by specific parties that the user        configures. For example, an image copyrighted by a business        competitor may be a problem for the user even if all other        copyright owners are not an issue. Scan for relevant        information, analyze, and address.    -   If a user attempts to send out an invitation to a future event        that may put those who respond at risk based on their responses        (Yes=They are not home, No because I am away my house may be        empty, etc.). Scan for relevant information, analyze, and        address.    -   Personal messages that should be sent as personal messages not        as public comments or posts are sometimes accidentally sent as        such. One way to find many of them is to scan for        comments/tweets/public messages sent to a user's parents,        children, spouse, or siblings. Scan for relevant information,        analyze, and address.    -   Language that may be used in a facetious way. Literal words can        be understood as a threat. Scan for relevant information,        analyze, and address.    -   Since information that is liked, sports teams that are        mentioned, celebrities that are mentioned, other interests that        are mentioned, etc. can be used in social engineering, it is        useful to keep this information private. Scan for relevant        information, analyze, and address.    -   Revealing the name of your employer can cause unscrupulous        parties to try to extrapolate information about the employer's        business, as well as facilitate social-engineering attacks        against the business and identity theft. Scan for relevant        information, analyze, and address.    -   Revealing one's email address or phone or cellphone number        online in a venue that also provides information about the user        can lead to a whole host of problems. Scan for relevant        information, analyze, and address.    -   If the user is not using an Internet security package—as is        often the case on mobile devices used to access social media—it        would be wise to warn about any links, downloads, etc. Scan for        relevant information, analyze, and address.    -   Posting family related matters to business colleagues or        viewable to business colleagues may present issues. Scan for        relevant information, analyze, and address.    -   Younger people posting when they are out sick—or kids posting        during the school day—may get them into trouble. Scan for        relevant information, analyze, and address.    -   People taking a sick day who comment about this online can get        themselves into trouble from their bosses at work—address. The        same goes for many extensions of this concept. Scan for relevant        information, analyze, and address.    -   Using words that may indicate problems not mentioned—e.g.,        mentioning a “hangover” in the morning may not be advisable for        various reasons. Scan for relevant information, analyze, and        address.    -   Anything that may indicate a deviation from the user's sexual        orientation as known to the public should be addressed. This        would include a heterosexual being seen at an event or venue        known to cater to homosexual dating, or vice versa. The same        would be true for any other type of controversial relationship        that deviates from a user's public persona. Scan for relevant        information, analyze, and address.    -   Items posted from locations far away from home may be        objectionable if the user is still away, but if he is home, or        has posted from home in between the time they were created and        posted they may be fine. For example, a photo taken in Hawaii        when the user lives in New York City may be problematic to post        while the user still is in Hawaii, but if he has already        returned to New York City and posted since then the system        should realize this and act accordingly. This can be determined        either by asking the user or by checking the date in a photo or        video versus the date it is being posted and seeing if posts        made locally to the person's home were made in between. Scan for        relevant information, analyze, and address.    -   If the user lists a home location in his profile, or a work        location, or both, but many of his posts on social media seem to        come from elsewhere this may indicate incorrect information or a        frequently traveling user which could expose him to risk as        described earlier. Scan for relevant information, analyze, and        address.    -   Posting one's home or office location can lead to        stalking—especially if this information is public. In some cases        a user may have no problems publishing it, in others he might.        Scan for relevant information, analyze, and address.    -   The same goes for gym locations or locations of other venues a        user frequents. Scan for relevant information, analyze, and        address.    -   If a user adds multiple parties from the M&A division of a firm,        or of a competing or tangential firm, it might indicate that M&A        activity is being considered. Scan for relevant information,        analyze, and address.    -   If a user adds multiple parties from a firm X as contacts that        might indicate that he or his employer is contemplating,        considering, pursuing, or actively working on a project with        firm X. The same goes for organizations. Scan for relevant        information, analyze, and address.    -   If a user is under a certain age and a contact with a much older        age is added who is not listed a relative that may be of        concern. Scan for relevant information, analyze, and address.    -   If a user adds a contact who is new on the social media        platform, there is a possibility that it is from a fake account.        Scan for relevant information, analyze, and address.    -   If a child adds a friend a person with whom the parents do not        want the child associating, this may be problematic. Scan for        relevant information, analyze, and address.

An organization/business producing rules for employees, a parent, or aregular user may establish custom terms for which scanning should occur.This may include positive match terms (if found there may be an issue sonotify) or negative match (even though such terms match another ruleignore the match and do not notify). For a business, for example,positive match terms may include keywords, acronyms, competitor info,key personnel names, tickers, names of firms with which businesses isbeing conducted, M&A targets, potential acquirers, partners, productnames, contemplated product names, locations related to the business,conferences related to the business, meetings related to the business,names of potential hires, government terms related to the business orpotential challenges to the business such as the name of an auditor,internal names of systems, procedures, and teams, payroll info, andemployee info and names. An example of a negative term—one that shouldbe ignored even though it matches on other rules—might be variousmedical terms if the user is a doctor—the terms might be sensitive for apatient to disclose, but a doctor writing an article about treating thecondition wants publicity, not privacy. An instantiation of theinvention in the case of a parent would be the parent putting the nameof someone with whom he does not wish his child to associate as apositive term.

Rewards

One aspect of the present invention is to provide rewards to users ofthe disclosed security system, thereby increasing use and enhancingsecurity. The user may be rewarded for using the system and makingedits, for time elapsed since he started using it, based on the numberof modifications made, or any other criteria that an implementer of theDSS so desires. The user will also have the opportunity to compete withhis or her contacts vis-à-vis how many rewards points he or she earns.At the end of some period of time for example, the DSS may issue bonuspoints for those who have earned the most, and “groups” may be awardedbonus points for hitting certain targets. This can motivate people toget their contacts (e.g., Facebook friends) to use the securitysoftware. Likewise, businesses can motivate their employees to use thesystem not only by explaining that by doing so they will protectthemselves, but also through rewards. The disclosed system may alsooffer a general option to cash out points in exchange for rewards—eithercash, miles, points in other point systems, or specific offers fromthird-parties.

Furthermore, implementations of the invention may allow users tosocialize their rewards—that is discuss the reward program, share theircurrent reward info, preferences and point tallies with parties whomthey deem appropriate to see such information. Control of thisinformation can be achieved via the same types of rules that arediscussed throughout this specification. Also, as an implementation ofthe invention a business can create an incentive program for employeesto use the security technology—either via recognition or providingrewards for those who use it above a certain threshold, the most, orsome other benchmark for reward.

Configuration

As noted previously, one aspect of the invention is the robustconfigurability provided for all stages of the security system. Variouscomponents or modules of the DSS may be configured by the user,overseer, administrator, or any other party granted access to configurethe system. To illustrate the flexibility of the DSS and itsconfigurability, the following examples are provided:

-   -   settings may be configured before usage. For example, as one        entry in the configuration, the user may specify that any time a        certain location is noted within his social media as the        location of a photo, a check-in, a posting, or other content,        the location should be removed.    -   no settings are configured before usage, but as various        potential issues are detected by the system the user is prompted        to provide guidelines on how to handle those particular issues        and whether to apply the rule that detected them in the future,        and if so, how strictly. Furthermore, the desired response to        such a rule may be configured at that point. For example, should        the system automatically delete a post that it detects as        violating a rule, should it warn the user about it but not yet        delete it, should it delete it and notify the user, should it        delay posting to social media for a while (temporary        quarantine), should it quarantine it—that is delete it from the        social media but ask the user whether to delete it or restore        it, should it suggest edits to content or settings (e.g., the        user may be OK with leaving a picture of something is it is seen        by only a specific group of users, but not by others—so suggest        that he set this to viewable by only a group as a possibility.),        and other possibilities. In some embodiments, the user may be        asked how he or she should be notified of potentially        problematic content—for example, by text message, email,        social-media message (e.g., Twitter Tweet, Facebook message, or        other platform), or other communication means. In some        embodiments the system may only notify users, but not offer the        ability to remove or quarantine the offending material.    -   some settings are configured before usage, and some settings are        configured during usage.    -   one or more rule sets, which may be standard or default sets,        are selected by a user, and then edited before usage, during        usage, or in some combination.    -   a configuration is received by a user from another user, or from        a backup of his own configuration. The user may instruct the        system to use the received configuration.    -   businesses or organizations may set up an overall management        “account” and within the account create one or more settings,        including rule sets for scanning, contacts control, and other        conditions that are applied to users who authorize the business        or organization settings to apply to their social media        profiles.

As one of ordinary skill in the art would recognize, other configurationoptions exist as well.

Configuring the system may be accomplished in a variety of ways,including uploading a configuration file to a DSS server, accessing aweb-based configuration interface by entering an IP address or apre-configured host name into a browser, following text based prompts ona terminal screen, or interacting with the DSS via text messages, socialmedia, or e-mail, among other options.

One embodiment of a web-based configuration interface is illustrated inFIG. 21. After logging into system, whether by entering a login/passwordcombination, or through other authorization and/or authentication means,such as by uploading a cryptographic key or encrypted file, the user oradministrator is presented with a “Users and Groups” screen. The screenlists all individuals and groups that have been pre-configured by XYZCorp.'s IT department, including the CEO and Zack Smith, who areindividuals, and Groups for Executives, IT Department, MarketingDepartment, Outside Consultants, and Product Development Department. Inorder to configure settings and rules for any of the listed users orgroups, the administrator need only select or click on the desired useror group name, and then set up corresponding rules and settings. Theadministrator may also select multiple groups or users from the list, tochange settings in bulk.

FIG. 22 illustrates one embodiment of a web-based screen used toconfigure rules for a group. In FIG. 22, the user has already clicked onthe Marketing Department link in the previous screen, illustrated inFIG. 21. In this embodiment, the Rules screen for the MarketingDepartment lists various platform names, and various rules underneatheach platform name. In this example, a Platform may be a social mediaplatform like Facebook or Twitter. Various rules, described in detailabove, are available for each platform, and may from platform toplatform depending on the specifics of how each platform functions. Inthe illustrated example, the administrator has selected check boxes forboth Platform Name A and Platform Name B. However, the administratorchose to select only the first rule appearing under Platform Name A, andonly the second rule appearing under Platform Name B. Once theadministrator saves the settings (or they are saved automatically basedon a timer or clicking action), the DSS will update its runtimeconfiguration and begin implementing the rules selected by theadministrator in FIG. 22.

In another embodiment, the web-based configuration utility provides agraphical user interface with a matrix containing a selection list ofvariables or rules in one column and a list of possible actions in asecond. It may also include a third column that specifies groups orusers. For example, in a rule that checks content for the presence of ageographic location, such as a photograph of the user that has beengeotagged, a user may further refine the rule by allowing the sharing ofcontent by a “group of close relatives” and request warnings if thecontent is shared by all other groups.

Each element of configuration, including rules and other variables, canbe used by itself or in combination with others. For example,configuring which variables to look for and which rules to apply, whatactions should be taken when a rule applies, which partners a user wantsto be rewarded with or whether they want to earn general points forusing security with proper secure behavior, may all be combined tocreate rule sets. All of this can be configured either on initial use,or as rules are triggered, or via a configuration option within the appor interface of the DSS as it runs.

In another aspect of the invention, a template may be provided to abusiness or organization indicating the types of items that should bescanned for in social media. An example of this might include: productand product line names and terms, service and service line names andterms, marketing terms, internal keywords, employee names, locations,competitor names and product/service related terms, M&A related keywordsand names, terms related to strategy, ticker symbols, internal acronyms,internal keywords, project names, intellectual property terms, peoplethe firm is looking to hire, as well as other sensitive items. Forhousehold use, a template may indicate to a parent types of items thathe or she should ensure his or her child is protected from on socialmedia.

When the system starts up the first time it may ask the user somequestions depending on the implementation—e.g., what is yourprofession—in order to optimize compliance type scanning. If thisinformation is already in his profile (from Facebook, LinkedIn,Instagram, Pinterest, Twitter, or other social media profiles) then thesystem will obtain the information from the existing profile.

In another aspect of the invention, the DSS also includes capability fora business or other entity to create an account that will establishrules for social media that the DSS will use to detect issues, and tohave users agree to accept those rules, or to authorize the rule setmanaged by the entity to be integrated with the users' scan profiles. Byemploying this mechanism, the DSS allows a business to establish rulesfor social media scanning that employees can accept so that theemployees will be notified if they—or someone else tagging them—violatessuch rules. Some implementations of the invention may pass an entirerule set from an employer to an employee upon authorization, whileothers may pass a subset of rules while the employee controls theothers. If an employee deauthorizes the employer and its rule set, theemployer would preferably be notified of such action by the DSS.

In one embodiment, an employer, for example, might establish an accountfor which it can set up a set of rules, or perhaps multiple sets ofrules each of which will be intended for a different group of users. Theemployer may then ask employees to authorize the app (in an app basedimplementation for the invention) and may examine periodic reports tosee who has authorized it and who has not. The organization would alsohave an interface to manage rule sets, groups, users, any notificationsit receives (such as those concerning employees who do not act onwarnings from the system if those warnings are then to be sent to theemployer as discussed above). Similar provisions can be made for parentsand guardians.

To maximize use of the DSS, businesses may explain to their employeesthat an implementation of the invention will help them safe fromviolating employer policy, and offer it for use. To educate employeesand other individuals on best security practices, and how to maximizebenefits from the disclosed security system, businesses andorganizations may offer training and classes in those topics. Thetraining and classes may be offer via the Web or other presentationmethod by the disclosed system.

What is claimed is:
 1. A method for securing information fromunintentional publication on social media sites, comprising: receiving,at a social media server, a request to publish information; analyzingthe request pursuant to one or more pre-configured rules; and performingan action with respect to the request in accordance with the one or morepre-configured rules.
 2. The method of claim 1, wherein performing anaction with respect to the request comprises: providing a warning to theuser regarding the request to publish information.
 3. The method ofclaim 2, further comprising: providing the user with one or more optionsfor possible actions relating to the request to publish information. 4.The method of claim 3, wherein the request to publish informationcomprises a request to publish a digital photograph.
 5. The method ofclaim 3, wherein the request to publish information comprises a requestto post a comment.
 6. The method of claim 1, wherein the rules arepre-configured by the user.
 7. The method of claim 1, further comprisingdetermining whether the request to publish information was initiated inresponse to social media content.
 8. The method of claim 7, furthercomprising: in response to determining whether the request to publishinformation was initiated in response to social media content,determining the type of social media content.
 9. The method of claim 8,wherein the social media content was the post of a different user.
 10. Amethod for protecting users from unintentional disclosure of informationon social media sites, comprising: detecting a user's attempt to performa social media action; analyzing the user's attempt pursuant to one ormore pre-configured rules; and responding to the user's attempt inaccordance with the one or more pre-configured rules.
 11. The method ofclaim 10, wherein the analyzing the user's attempt pursuant to one ormore pre-configured rules comprises accessing one or more databasesstoring the one or more rules.
 12. The method of claim 10, furthercomprising determining whether a user's attempt to perform a socialmedia action was made in response to a different user's social mediaaction.
 13. The method of claim 12, further comprising, in response tothe determining whether a user's attempt to perform a social mediaaction was made in response to a different user's social media action,determining the type of the different user's social media action. 14.The method of claim 13, wherein the different user's social media actionwas the posting of a comment.
 15. The method of claim 13, wherein thedifferent user's social media action was the posting of a digitalphotograph.
 16. A method for providing information security services toa user of social media, comprising: creating a user profile based oninformation supplied about a user; searching one or more social mediawebsites for content relating to the user based on the created userprofile; analyzing the content relating to the user available on the oneor more social media websites; creating a database object; andpopulating the database object with data obtained by analyzing thecontent relating to the user available on the one or more social mediawebsites.
 17. The method of claim 16, wherein the user profile compriseslogin information to the ones or more social media websites.
 18. Themethod of claim 17, further comprising: logging into the one or moresocial media websites.
 19. The method of claim 18, further comprising:presenting the user with a list of content relating to the useravailable on the one or more social media websites.
 20. The method ofclaim 19, further comprising: providing the user with one or moreoptions for possible actions relating to the content relating to theuser available on the one or more social media websites.